Legal & Risk: What Businesses Need to Watch

Legal & Risk: What Businesses Need to Watch – 2026‑09‑21

In a year when headlines scream of cyber‑attacks, infrastructure gaps and legacy legislation, the quiet legal risks that slip through daily operations can be far costlier. Below are three stories that illustrate hidden compliance traps many commercial leaders miss, plus concrete actions for your CLO or risk team.

---

1. Hollard client data dumped on the dark web – TechCentral

A ransomware hit on MIP Holdings has released confidential funeral‑policy information belonging to Hollard’s customers into the black market. On the surface this is a cyber‑crime story, but under South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA) the fallout is legal‑driven.

Legal gaps most missed

| Gap | Why it matters | Immediate consequence |

|-----|----------------|------------------------|

| 72‑hour reporting window | POPIA requires data controllers to notify the Information Regulator and affected individuals “within the shortest period of time and, in any event, within 72 hours” (Hollard client data dumped on the dark web — TechCentral – TechCentral). | Failure to meet this deadline can trigger statutory sanctions up to R1 million per offence. |

| Reasonable safeguards | If a controller is found negligent in implementing technical and organisational measures, the regulator may impose fines or require remedial action (Hollard client data dumped on the dark web — TechCentral – TechCentral). | Civil claims for damages from policyholders become likely, with potential reputational fallout. |

| Cross‑border data | Should any personal information belong to EU citizens, POPIA’s breach notification would also trigger the General Data Protection Regulation (Hollard client data dumped on the dark web — TechCentral – TechCentral). | Dual‑jurisdiction enforcement can lead to coordinated investigations and higher fines. |

Compliance actions for a CLO

• Audit existing safeguards – Verify that encryption, access controls and incident‑response playbooks meet POPIA’s “reasonable” standard.
• Establish a 72‑hour reporting protocol – Include automatic alerts to the compliance team and pre‑draft notification templates.
• Cross‑border data mapping – Conduct an inventory of EU citizen data to assess GDPR exposure and prepare joint notification plans.

---

2. No government kill switch for South African Internet in a cyber emergency – MyBroadband

The Communications Minister confirmed that South Africa has no statutory mechanism to seize or shut down privately owned networks during a national crisis (No government kill switch for South African Internet in a cyber emergency — MyBroadband – MyBroadband).

What this means for businesses

| Risk | Impact |

|------|--------|

| Unplanned outages | Without a central “kill switch”, service disruptions during large‑scale attacks are harder to mitigate, increasing downtime risk. |

| Regulatory ambiguity | The absence of an enabling law leaves private operators unsure of their obligations under the Communications Act 53 of 1999 and related regulatory guidance. |

| Data protection breach | If critical data centres cannot be isolated quickly, POPIA‑covered information may be exposed or corrupted, triggering reporting duties. |

Compliance actions for a CLO

• Enhance cyber resilience plans – Require redundancy across ISPs, implement network segmentation and test fail‑over procedures under various attack scenarios.
• Document contingency agreements – Formalise arrangements with key vendors to secure rapid shutdown or isolation capabilities in emergencies.
• Legal review of ISP contracts – Ensure clauses reflect obligations for emergency coordination, liability allocation, and compliance with POPIA during outages.

---

3. South Africa must say goodbye to an Apartheid‑era law which still holds the country back – MyBroadband

Exchange controls, codified in the Capital Flow Management Regulations and the accompanying Crypto Assets Manual, remain a relic that stifles modern fintech activity (South Africa must say goodbye to an Apartheid-era law which still holds the country back — MyBroadband – MyBroadband).

Key legal pitfalls

| Pitfall | Why it matters |

|---------|----------------|

| Regulatory retrofitting | Businesses must now adapt legacy rules to new technology, often without clear guidance. |

| Cross‑border compliance | International crypto exchanges face conflicting regimes, risking sanctions under SA law and foreign AML/CFT standards. |

| Licensing uncertainty | Entities operating in digital asset services may inadvertently breach licensing thresholds or anti‑money‑laundering statutes. |

Compliance actions for a CLO

• Map regulatory exposure – Identify all capital‑flow and crypto‑asset activities within the company’s portfolio.
• Engage with regulators – Join industry forums to influence forthcoming revisions and secure clarifications on licensing thresholds.
• AML/CFT alignment – Update anti‑money‑laundering policies to reflect both SA regulations and the expectations of major overseas jurisdictions.

---

Review Note

The analysis above draws exclusively from the supplied sources, but certain interpretations—particularly those linking POPIA compliance gaps with potential GDPR exposure or the strategic implications of abolishing exchange controls—require confirmation by a qualified South African counsel versed in data protection law and financial regulation. Additionally, the precise operational impact of the absence of an internet “kill switch” on contractual vendor risk warrants legal scrutiny.

---